# Data filter not working properly

**URL:** https://discuss.elastic.co/t/data-filter-not-working-properly/152802
**Category:** Logstash
**Created:** [October 17, 2018, 10:20am UTC](https://discuss.elastic.co/t/data-filter-not-working-properly/152802 "2018-10-17T10:20:01Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![idrees](https://avatars.discourse-cdn.com/v4/letter/i/58956e/32.png) [@idrees](https://discuss.elastic.co/u/idrees)
#### Post date: [October 17, 2018, 10:20am UTC](https://discuss.elastic.co/t/data-filter-not-working-properly/152802/1 "2018-10-17T10:20:01Z")

</div>

Dear All,  
i have the following date format

> 6/1/2016 0:00

the date filter of my logstash file is below

> date {  
> match =\> ["TMSTAMP", "MM/dd/yyyy hh:mm"]  
> target =\> "@timestamp"

but when i query it in the dev tools in kibana, the @timestamp is like below

> "@timestamp": "2018-10-17T10:59:36.297Z"

its taking the system date instead.  
how can i fix this?

thanks

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [October 18, 2018, 9:43am UTC](https://discuss.elastic.co/t/data-filter-not-working-properly/152802/2 "2018-10-18T09:43:42Z")

</div>

It probably doesn't work because your date is actually "M/d/yyyy H:mm". Your pattern does not match, so the @timestamp is not changed and a "\_dateparsefailure" tag is added instead.

---

<div class="post-metadata">

### Author: ![idrees](https://avatars.discourse-cdn.com/v4/letter/i/58956e/32.png) [@idrees](https://discuss.elastic.co/u/idrees)
#### Post date: [October 18, 2018, 9:58am UTC](https://discuss.elastic.co/t/data-filter-not-working-properly/152802/3 "2018-10-18T09:58:00Z")

</div>

its working now, but the time is wrong in the timestamp. can you guide please?

> "@timestamp": "2014-11-17T19:49:00.000Z",

> "message": "11/17/2014 23:49

you see, in the message, the origional time is 23:49, while in the @timestamp, i see 19:49

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/0/6031b9a978a903e1017aaf32234434019fe3fb73.png)  
why?

---

<div class="post-metadata">

### Author: ![idrees](https://avatars.discourse-cdn.com/v4/letter/i/58956e/32.png) [@idrees](https://discuss.elastic.co/u/idrees)
#### Post date: [October 18, 2018, 10:03am UTC](https://discuss.elastic.co/t/data-filter-not-working-properly/152802/4 "2018-10-18T10:03:00Z")

</div>

may be i am not providing timezone? how would i know my timezone? and how to add in the below logstash file

> date {  
> match =\> ["TMSTAMP", "M/d/yyyy H:mm"]  
> target =\> "@timestamp"  
> }

because i see all the dates are correct, but all the times are difference in kibana dev tools

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [October 18, 2018, 10:47am UTC](https://discuss.elastic.co/t/data-filter-not-working-properly/152802/5 "2018-10-18T10:47:19Z")

</div>

I think right now IT IS using your timezone. The default for the "timezone" setting is the platform default (UTC + 4 ?) and the dev tools show you the corresponding Zulu time (because ES always uses UTC). If your logs' timezone and your server settings are different from each other, you'll have to provide the timezone in your logstash settings.  
For example: If your logs are already UTC, you'd add timezone =\> "UTC"

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2018, 10:55am UTC](https://discuss.elastic.co/t/data-filter-not-working-properly/152802/6 "2018-11-15T10:55:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
